Ricky White EndlessTrax

Ways to hack django apps...

A page of ideas on how I would look to compromise Django applications..

Django comes with a automatic HTML escaping filter, so most XSS is stopped by the automatic escaping in views

There are places where it doesn't work (e.g https://docs.djangoproject.com/en/3.0/ref/templates/language/#automatic-html-escaping)
If you use it inside tag attributes, you could escape the attribute and set other attributes (e.g. onclick)

pip3 install pipenv

pipenv shell

$/
  artifacts/
  build/
  docs/
  lib/
  packages/
  samples/
  src/
 tests/

	<# My $PROFILE; https://gist.github.com/amigus/26cfb6cc8578ef783668c0b9346bd26c #>

	$ConfigDirectory = Get-Item $PROFILE \| Select-Object -ExpandProperty DirectoryName

	#region $env:Path
	<#
	The PSPaths.ps1 file is a list of expressions that evaluate to folder names e.g.
	$env:USERPROFILE + '\.local\bin'
	#>
	foreach ($DirectoryExpression in Get-Content "${ConfigDirectory}\PSPaths.ps1") {

	"""
	image2ansi.py
	usage: image2ansi.py [-h] [--no-color] [--width WIDTH] path
	Display an image in ASCII with ANSI colors
	positional arguments:
	path the path to the image file
	optional arguments:
	-h, --help show this help message and exit
	--no-color no ANSI colors
	--width WIDTH output width in characters (Default 120)

	Mute these words in your settings here: https://twitter.com/settings/muted_keywords

	ActivityTweet
	generic_activity_highlights
	generic_activity_momentsbreaking
	RankedOrganicTweet
	suggest_activity
	suggest_activity_feed
	suggest_activity_highlights
	suggest_activity_tweet